Strawberry

Table of Contents

• About
• Security Considerations
• Request Validations
• Notable Vulnerabilities
• Security Disclosure

About

Language: python
Source:

• https://github.com/strawberry-graphql/strawberry
• https://github.com/graphql-python/graphql-core

Documentation: https://strawberry.rocks/

Security Considerations

Strawberry provides the following features which should be taken into consideration:

Field Suggestions	Query Depth Limit	Query Cost Analysis	Automatic Persisted Queries	Introspection	Debug Mode	Batch Requests
✅ Enabled by Default	⚠️ Disabled by Default	❌ No Support	❌ No Support	✅ Enabled by Default	❌ No Support	❌ No Support

Request Validations

Total Validation Count: 34

Strawberry is based on graphql-core which validates the following checks when a query is sent:

Document Validations	Operation Validations	Field Validations	Argument Validations	Fragment Validations	Value Validations	Directive Validations	Variable Validations	Misc. Validations
Executable Definitions	Lone Anonymous Operation	Fields On Correct Type	Known Argument Names	Fragments On Composite Types	Known Type Names	Known Directives	No Undefined Variables
Lone Schema Definition	Unique Operation Names	Overlapping Fields Can Be Merged	Provided Required Arguments	Known Fragment Names	Possible Type Extensions	Unique Directive Names	No Unused Variables
		Scalar Leafs	Unique Argument Definition Names	No Fragment Cycles	Unique Enum Value Names	Unique Directives Per Location	Unique Variable Names
		Single Field Subscriptions	Unique Argument Names	No Unused Fragments	Unique Operation Types		Variables Are Input Types
		Unique Field Definition Names	Possible Fragment Spreads		Unique Type Names		Variables In Allowed Position
		Unique Input Field Names	Unique Fragment Names		Values Of Correct Type

Security Disclosure

https://github.com/strawberry-graphql/strawberry/issues